CVE-2025-39955

The CVE-2025-39955 entry concerns the Linux kernel TCP Fast Open path. The root cause is that tcp_disconnect() failed to clear tcp_sk(sk)->fastopen_rsk, allowing the retransmit timer to trigger while a TFO socket is being reused, potentially delaying or missing a retransmission. The fix implem...

CVE-2026-23149

Summary: CVE-2026-23149 affects the Linux kernel DRM subsystem, specifically drm_gem_change_handle_ioctl(). The vulnerability arises because GEM buffer object handles are u32 in the user API while internal idr_alloc() uses int ranges, causing a kernel warning (WARN_ON_ONCE) when a handle larger t...

CVE-2026-23172

Technical details for CVE-2026-23172 are not publicly available in the provided documents; monitor for updates.

CVE-2026-31622

Summary (CVE-2026-31622): In the Linux kernel NFC digital subsystem, the NFC‑A cascade depth handling in digital_in_recv_sdd_res() could allow a malicious peer to keep sending cascade responses, causing writes past the allocated nfc_target buffer (heap overflow) by exceeding the cascade depth. Th...

CVE-2026-43083

The CVE pertains to Linux kernel ioam6: a fix for an out-of-bounds access in skb_get_tx_queue when is_input is true, caused by a RX->TX queue-mapping mismatch (ingress device having more RX queues than egress TX queues). The issue could access dev->_tx[] beyond its bounds. A lock around qdi...

CVE-2026-43366

Summary: CVE-2026-43366 affects the Linux kernel’s io_uring/kbuf recycling path. A gap existed between when a buffer was grabbed and when it could be recycled; if the target list is empty, it could be upgraded to a ring-provided type without proper validation. The issue arises from missing checks...

CVE-2026-46115

In the Linux kernel block subsystem, CVE-2026-46115 was addressed by adding a check so that zone_device_pages_have_same_pgmap() prevents merging bvec segments that span different dev_pagemaps in biovec_phys_mergeable. Root cause: biovec_phys_mergeable() did not verify that two physically contiguo...

CVE-2026-46173

CVE-2026-46173 concerns the Linux kernel. The issue arises when an already-exiting task oopses and make_task_dead() calls do_task_dead() with preemption enabled, while __schedule() must be called with preemption disabled. If a preempted oopsing task is still in the dead-state, finish_task_switch(...

CVE-2026-46226

CVE-2026-46226 affects the Linux kernel SPI FSL driver, where deregistration of the controller was not ensured before releasing DMA resources during driver unbind. The issue is fixed in updated kernels across multiple OS packages (e.g., Root:Debian-11/12, Ubuntu 22.04+, Debian/Ubuntu roots with r...

CVE-2026-53185

CVE-2026-53185 concerns the Linux kernel zram subsystem. The issue is a use-after-free in zram_bvec_write_partial(), where zram_read_page() can dispatch reads asynchronously for ZRAM_WB slots and return before the backing read completes. The caller may then operate on a buffer that is freed, risk...

CVE-2026-53202

The CVE-2026-53202 issue affects the Linux kernel component accel/ivpu in IPC receive handling. It describes a signed integer truncation when data_size from firmware is cast to a signed int, leading to a potential unsigned wraparound with large values (≥ 0x80000000). This could enable oversized m...

CVE-2026-53239

The CVE-2026-53239 issue is a Linux kernel use-after-free in the xfrm policy path, specifically in xfrm_policy_bysel_ctx(). A race between CPU0 deleting a policy and CPU1 rebuilding inexact policy bins can lead to UAF of the inexact bin, causing potential system instability or DoS. The fix prunes...

CVE-2026-64341

A use-after-free in the Linux kernel's USB iowarrior driver is triggered by a race between release() and disconnect(). Because mutex_unlock() is non-atomic, it may access a freed mutex structure after driver data is deallocated during disconnect. The fix replaces mutex-based lifetime management w...

CVE-2026-64382

CVE-2026-64382 describes a Linux kernel SMB client-use-after-free issue in SMB2_open() replay handling. The vulnerability arises because a response-bearing SMB2_open attempt could return a replayable error and free its response buffer; if SMB2_open_init() fails before the next send, cleanup may f...

CVE-2026-64383

CVE-2026-64383 affects the Linux kernel’s SMB2 client path, specifically the SMB2_flush() replay handling. The issue arises when a replayable flush response is received and a retry fails before a replacement response is stored, causing a second free of the stale buffer due to persistent bookkeepi...

CVE-2002-0060

CVE-2002-0060 affects the Linux kernel netfilter IRC DCC connection-tracking helper in 2.4.x (notably 2.4.14–2.4.18-pre8/9). The bug sets an overly broad conntrack mask, causing firewall rules to be more permissive than intended and potentially allowing inbound connections that bypass restriction...

CVE-2004-1144

Summary: CVE-2004-1144: A local privilege escalation in the Linux 2.4 AMD64 32‑bit emulation code was identified (Petr Vandrovec). The issue affects the AMD64 path in the 2.4 kernel, allowing a local attacker to gain privileges. Affected context (from connected sources): Red Hat and SUSE advisori...

CVE-2005-1264

The CVE-2005-1264 issue is a concrete flaw in Linux kernel 2.6.x where raw devices (raw.c) call the wrong function before passing an ioctl to block devices, exposing kernel address space to userspace. This local, privilege-escalation risk is corroborated across multiple advisories (e.g., RHSA-200...

CVE-2005-4618

CVE-2005-4618 corresponds to a Linux kernel local-denial-of-service issue caused by a buffer overflow in sysctl writes. Affected are Linux kernel 2.6.x before 2.6.15; exploitation could corrupt user memory or cause a denial of service via a long string, with the caveat that the vulnerability may ...

CVE-2006-4663

The Linux kernel versions 2.6.16 through 2.6.17.11 may contain a source code tar archive with weak permissions (0666 and 0777 ) for specific files and directories. This flaw could potentially allow local users to inject Trojan horse source code during the next kernel compilation. However, researc...

CVE-2013-2017

CVE-2013-2017 affects the Linux kernel veth driver: SKB handling during congestion is flawed, enabling a remote DoS (system crash) via lack of skb consumption and a double-free. Affected: kernel versions before 2.6.34; remediation is upgrading to a kernel version where the issue is fixed (2.6.34+...

CVE-2013-2636

The CVE-2013-2636 entry concerns the Linux kernel prior to 3.8.4, where net/bridge/br_mdb.c does not initialize certain structures. This can allow local users to read sensitive kernel memory via a crafted application. The issue is addressed by the 3.8.4 update (ChangeLog-3.8.4); remediation is to...

CVE-2013-3230

CVE-2013-3230 affects the Linux kernel prior to 3.9-rc7: l2tp_ip6_recvmsg in net/l2tp/l2tp_ip6.c fails to initialize a structure member, allowing local users to obtain sensitive information from kernel stack memory via a crafted recvmsg/recvfrom. The issue is mitigated by updating the kernel to 3...

CVE-2014-4323

The CVE-2014-4323 issue affects the Linux kernel 3.x MDP display driver (mdp_lut_hw_update in drivers/video/msm/mdp.c) used in Qualcomm QuIC Android MSM contributions. The vulnerability stems from insufficient validation of certain start and length values in an ioctl call, enabling privilege esca...

CVE-2015-4177

CVE-2015-4177 affects the Linux kernel, where the collect_mounts function in fs/namespace.c before 4.0.5 may run after a path has been unmounted. This can enable local users with user-namespace root access to trigger a denial of service (system crash) via an MNT_DETACH umount2 call. The vulnerabi...

CVE-2015-8019

The CVE-2015-8019 entry concerns the Linux kernel up to at least versions 3.14.54 and 3.18.22, where skb_copy_and_csum_datagram_iovec does not enforce a length argument. Root cause: a missing length argument in the function affects data handling in datagram processing, enabling local users to tri...

CVE-2016-8424

CVE-2016-8424 is an elevation-of-privilege in the NVIDIA Tegra GPU driver (NVMAP) that can let a local, unprivileged process execute code in kernel context by referencing memory after it has been freed (use-after-free). Affected: Android devices using the NVIDIA Tegra kernel driver (Kernel-3.10)....

CVE-2017-0332

CVE-2017-0332 affects the NVIDIA crypto driver in Android kernels (NVIDIA Tegra). The vulnerability arises from a heap-allocated buffer overwrite in the cryptodev path, which could allow a local attacker to execute arbitrary code in kernel context (privilege escalation). Android’s public bulletin...

CVE-2017-0429

CVE-2017-0429 is an elevation-of-privilege vulnerability in the NVIDIA kernel driver’s i2c-hid component, enabling a local attacker to write arbitrary values to kernel memory and potentially execute code with kernel privileges. Public descriptions tie the issue to the NVIDIA kernel driver on Andr...

CVE-2021-47133

CVE-2021-47133 affects Linux kernel; memory leak in the amd_sfh driver (HID: amd_sfh: Fix memory leak in amd_sfh_work) detected by kmemleak. Root cause: unreferenced kmem object in request_list handling; fix implemented as freeing the request_list entry once the processed entry is removed from th...

CVE-2021-47278

CVE-2021-47278 : Linux kernel vulnerability in the bus: mhi: pci_generic driver where the remove path used del_timer(), which may not wait for the timer handler to finish, causing a potential use-after-free. The fix is to replace del_timer() with del_timer_sync() to ensure the timer handler has f...

CVE-2021-47570

CVE-2021-47570 is addressed in the Linux kernel staging area (rt8188eu driver). The issue was a memory leak in rtw_wx_read32() where ptmp was not freed before returning -EINVAL. A fix (memory cleanup) has been applied to resolve this vulnerability; references point to kernel stable commits that i...

CVE-2022-48871

In CVE-2022-48871, the Linux kernel fix targets tty: serial: qcom-geni-serial slab-out-of-bounds on the RX FIFO buffer. The probe allocates port->rx_fifo using a default depth (e.g., 16); during serial startup, port->rx_fifo_depth is updated to match device capabilities (e.g., 32). The RX U...

CVE-2022-48914

CVE-2022-48914 affects the Linux kernel’s xen_netfront/xennet_destroy_queues path. The vulnerability arises because xennet_destroy_queues() relies on netdev->real_num_tx_queues, which is cleared after unregister_netdev() due to net-sysfs changes, causing a NULL dereference when freeing queues ...

CVE-2022-49030

The CVE-2022-49030 issue affects the Linux kernel component libbpf, specifically a size overflow in ringbuf mmap when mapping producer and data pages. The root cause is an overflow of the 32-bit read/write region size (max 2GB ringbuf on x86-64) due to computing 2 * max_entries, which can overflo...

CVE-2022-49883

CVE-2022-49883 is a Linux kernel KVM x86 vulnerability related to SMM handling. The issue arises because the number of general purpose registers (GPRs) used for the SMRAM image depends on the image format. On 64‑bit hosts, if the guest lacks X86_FEATURE_LM, KVM may access 16 GPRs for a 32‑bit SMR...

CVE-2022-50197

In CVE-2022-50197, the Linux kernel vulnerability affects the cpufreq: zynq component. The root cause is a refcount leak when retrieving a device node: of_find_compatible_node() returns a node pointer with an incremented refcount, and missing of_node_put() on cleanup leads to a leak. The fix adds...

CVE-2022-50223

CVE-2022-50223 affects the Linux kernel on LoongArch where, when CONFIG_CPUMASK_OFFSTACK and CONFIG_DEBUG_PER_CPU_MAPS are enabled, cpu_max_bits_warn() could trigger a runtime warning during /proc/cpuinfo display. The issue arises from iterating CPUs using NR_CPUS and is fixed by using nr_cpu_ids...

CVE-2023-20847

CVE-2023-20847 affects MediaTek chips, specifically the imgsys_cmdq component, where a missing valid range check can cause an out-of-bounds read. This vulnerability can lead to local denial of service with SYSTEM privileges required, and exploitation requires user interaction. The known remedy in...

CVE-2023-52942

CVE-2023-52942 affects the Linux kernel’s cgroup/cpuset subsystem. The root cause was an incorrect check in update_parent_subparts_cpumask() that could allow a parent cpuset to be left with no effective CPUs even when there are tasks in it, potentially causing a system panic. The fix alters the e...

CVE-2024-46837

CVE-2024-46837 affects the Linux kernel component for the DRM panthor uAPI, specifically the group_create path. The vulnerability arose from missing permission checks allowing non-privileged users to create high-priority groups. The underlying fix restricts who can set higher-than-MEDIUM prioriti...

CVE-2024-58240

The CVE-2024-58240 entry concerns the Linux kernel TLS path, specifically separating no-async decryption request handling from async flow. The described issue centers on a race in the TLS decryption handling (no-async vs async) and notes that a prior patch (aec7961916f3) addressed a UAF risk rela...

CVE-2025-37941

CVE-2025-37941 affects the Linux kernel ASoC: codecs/wcd937x. The issue is a potential memory leak in wcd937x_soc_codec_probe() when snd_soc_dapm_new_controls() or snd_soc_dapm_add_routes() fail, because the allocated wcd937x->clsh_info is not released. The root cause is missing cleanup in err...

CVE-2025-38329

CVE-2025-38329 – Linux kernel: firmware: cs_dsp: fixes OOB memory read in KUnit test (wmfw info). KASAN reported out-of-bounds access in cs_dsp_mock_wmfw_add_info() where source string length was rounded up to the allocation size. Impact: local attacker with LOW privileges; confidentiality and av...

CVE-2025-38526

CVE-2025-38526 : In the Linux kernel, the ice driver adds a NULL check in eswitch lag validation to prevent a NULL-pointer dereference when lag->upper_netdev is NULL. The root cause was ice_lag_is_switchdev_running() being invoked outside the LAG event handler, potentially dereferencing a NULL...

CVE-2025-38601

Mode C: The CVE-2025-38601 entry concerns the Linux kernel, specifically the ath11k/ srng handling. The root cause described across sources is that after two crash/recovery cycles, ath11k_hal_srng_deinit() destroys srng lists but does not reset per-list ->initialized flags. A subsequent call t...

CVE-2025-39798

CVE-2025-39798 concerns the Linux kernel’s NFS automount handling. The issue arises from how capabilities are set across a new filesystem boundary: capabilities cannot be inherited when crossing into a new filesystem, so they must be reset to minimal defaults and probed again. The connected advis...

CVE-2025-71088

CVE-2025-71088 affects the Linux kernel’s mptcp implementation. Syzkaller reported a simult-connect race in net/mptcp/subflow.c where a TCP subflow can process a simult-ack after transitioning to TCP_FIN1, bypassing the MPTCP fallback check and leaving the socket in an inconsistent state; this ca...

CVE-2026-23394

CVE-2026-23394 – af_unix GC race with MSG_PEEK (Linux kernel) : A race between MSG_PEEK and garbage collection can cause the GC to incorrectly GC dead sockets, since MSG_PEEK silently bumps a file refcount. The issue originates from a change in the current GC algorithm and the removal of the lock...

CVE-2026-23452

CVE-2026-23452 refers to a race condition in the Linux kernel PM: runtime code during device removal. The root cause described is the potential dereference of the parent device pointer (parent->power) after the parent is freed within pm_runtime_work(), which could lead to a use-after-free scen...